NTLM pass-the-hash shows why Active Directory controls still matter

At a glance

What this is: NHI Mgmt Group's analysis, drawing on IS Decisions's blog post: NTLM pass-the-hash still works in Active Directory, and MFA alone does not stop it.

Why it matters: It matters because identity teams need to understand where protocol-level authentication weaknesses still let attackers move laterally even after a user account is compromised.

Context

NTLM is a legacy authentication protocol that still appears in many Active Directory environments because of fallback use, older applications, and compatibility pressure. That persistence matters because the protocol's design still leaves reusable hashes in memory, creating a path for pass-the-hash abuse even when the password itself is never cracked.

The governance gap is not just outdated protocol usage, but incomplete control over how far a compromised account can move once authentication is bypassed. For identity programmes, this is a classic case where the control problem is lateral movement containment, not initial login hygiene.

The article's core message is that organisations often know NTLM is weak but still do not know where it remains enabled, which leaves the protocol available to attackers after a foothold is gained.

Key questions

Q: What breaks when NTLM is still enabled in Active Directory?

A: NTLM preserves a replayable trust path that attackers can abuse once they obtain cached hash material from a compromised endpoint. The result is not just weaker authentication, but a lateral movement path that bypasses password cracking and can turn one host compromise into broader directory access.

Q: Why does pass-the-hash increase lateral movement risk so much?

A: Because it lets an attacker reuse a valid internal credential instead of hunting for a new one at every step. Once the hash is captured, the attacker can impersonate the account wherever that identity is accepted, and any extra privileges on the account expand the reachable systems. That is why lateral movement often follows quickly after the first foothold.

Q: How can security teams know whether NTLM is still actually needed?

A: They should inventory applications, devices, and service accounts that still generate NTLM traffic, then test whether Kerberos, local KDC, or IAKerb can replace that dependency. If a system still requires NTLM, the exception should be documented, time-bound, and owned.

Q: How should teams limit damage when MFA does not stop protocol replay?

A: Treat MFA as one layer, not the control that ends the risk. Add contextual access restrictions, session limits, and endpoint hardening so a replayed hash cannot be used broadly after sign-in. The objective is to shrink what the authenticated account can reach if the protocol is abused.

Technical breakdown

Why NTLM still enables pass-the-hash

NTLM reuses a password hash during authentication instead of forcing a fresh password entry, which means the hash itself becomes the credential. Because the hash is cached in memory on the workstation and transmitted for re-authentication, an attacker who can extract it can impersonate the user without cracking the password. The weakness is structural, not just operational: the protocol was built around a trust model that assumes the hash can stay secret and static. Once that assumption fails, replay becomes the attack path.

Practical implication: identify where NTLM is still allowed and treat any hash exposure as credential compromise, not just suspicious activity.

How lateral movement expands after the first foothold

Pass-the-hash is attractive to attackers because it turns a single compromised workstation into a launch point for broader internal access. Once the attacker has local administrative rights, they can harvest hashes from memory, reuse them across services, and impersonate the user wherever that account is trusted. The risk compounds when ordinary users have accumulated privileges over time, or when admin accounts are exposed on compromised endpoints through remote access. In practice, the attack shifts the problem from password theft to trust reuse across the directory.

Practical implication: reduce the trust radius of every endpoint and session so one compromised workstation cannot become a reusable launch point.

Why MFA does not stop protocol-level abuse

MFA protects the interactive sign-in flow, but pass-the-hash operates below that layer in the authentication protocol itself. That is why a valid hash can be replayed without triggering the MFA challenge that would normally protect a password-based login. The control gap is architectural: if the protocol accepts the hash as proof of identity, higher-level authentication checks may never be reached. Active Directory environments therefore need controls that constrain where and how the authenticated account can be used, not just how it is initially verified.

Practical implication: pair MFA with endpoint, session, and contextual access controls that constrain post-authentication movement.

Threat narrative

Attacker objective: The attacker wants to impersonate a trusted internal user and expand from one compromised endpoint into wider Active Directory access.

1. Entry occurs when the attacker compromises a user workstation or account in an Active Directory environment where NTLM is still enabled.
2. Credential access follows when the attacker gains local administrator rights and extracts the NTLM hash from memory, often from LSASS or a similar cache location.
3. Lateral movement begins when the captured hash is replayed inside an NTLM authentication exchange to access other services and systems the account can reach.
4. Impact expands as the attacker impersonates the user, harvests more credentials, and potentially reaches higher privilege accounts or broader domain access.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Pass-the-hash survives because NTLM treats a reusable hash as a valid trust artefact. That design was acceptable when the protocol was expected to be replaced, but it becomes a governance liability when the protocol lingers in production. The practical implication is that identity teams must treat NTLM presence as an active trust decision, not a legacy leftover.

Active Directory privilege creep turns a single NTLM compromise into a broader identity event. The article correctly notes that ordinary users often accumulate access over time, which increases the blast radius once the hash is replayed. That means the real security problem is not only the protocol, but the unmanaged growth of what the account can do after authentication succeeds.

MFA cannot be the control story for protocol abuse because the attack bypasses the authentication layer it protects. This is a useful reminder that identity controls are layered, and a strong control at the login screen does not neutralise a weaker protocol underneath. The implication for practitioners is to focus on endpoint trust, session limits, and context-aware access, because the first factor check is not where this attack lives.

Active Directory hardening is now as much about containment as it is about authentication. When organisations continue to depend on NTLM for compatibility, they are accepting a residual attack path that modern identity programmes must narrow through monitoring and access restrictions. The lesson is to reduce where reusable credentials can be harvested, replayed, and escalated before they become an internal movement channel.

Identity blast radius is the more useful concept here than simple credential hygiene. The question is not only whether a hash can be stolen, but how far that stolen trust can travel across accounts, sessions, and systems. Practitioners should therefore measure the scope of abuse an attacker can achieve after one foothold, because that is where NTLM still creates disproportionate risk.

What this signals

Identity blast radius is the right lens for NTLM risk: the question is no longer whether a password can be cracked, but how far a replayed hash can travel once an endpoint is compromised. That shifts programme attention toward session boundaries, admin pathway control, and the systems that still accept legacy authentication.

If NTLM remains in the environment, Active Directory hardening should be measured by containment rather than by login success rates alone. MFA reduces initial footholds, but the durable control problem is whether a compromised account can reuse trust across multiple systems.

For practitioners

• Inventory NTLM dependencies Map every application, server, and fallback path still using NTLM so you can see where pass-the-hash remains viable. Prioritise the systems that also expose privileged sessions or remote administration paths.
• Restrict administrative workstation use Block admins from using Remote Desktop or other privileged logins on endpoints that are not trusted, patched, and tightly monitored. A compromised workstation is the fastest route from one hash to broader domain access.
• Pair MFA with session controls Use MFA as a foothold-reduction control, then add concurrent session limits, contextual access rules, and prompt restrictions to limit what happens after authentication. That combination matters because MFA alone does not intercept protocol replay.
• Monitor for hash-reuse movement Watch for odd-hour logins, repeated session creation, and account activity that suggests the same identity is being replayed across multiple systems. These patterns help expose pass-the-hash before it becomes domain-wide movement.

Key takeaways

• NTLM still creates a practical attack path because reusable hashes can be replayed inside the protocol even when the password is never recovered.
• The risk is amplified by privilege creep and by administrative logins on untrusted endpoints, which let one compromise expand into broader internal access.
• Containing the attack requires more than MFA, because the durable control problem is where the authenticated identity can move after sign-in.

Key terms

• Pass-the-Hash: An authentication abuse technique where an attacker uses a stolen password hash instead of the cleartext password. It matters in Windows environments because cached credentials can sometimes be enough to gain access, turning one compromised host into a broader lateral movement opportunity.
• NTLMv1: NTLMv1 is an older Microsoft authentication protocol used in Windows environments. It relies on weak cryptography and limited challenge-response protection, which makes captured traffic easier to crack or reuse. In modern Active Directory estates, it is treated as a legacy risk because it can support replay, relay, and offline credential attacks.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.

Deepen your knowledge

NHI governance, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.